AWS acm documentation change
Summary
Changed documentation from describing advanced certificate search capabilities to basic certificate listing, removing detailed filtering, sorting, and pagination information for SearchCertificates operation and replacing with simpler ListCertificates operation.
Security assessment
This is a documentation restructuring that changes the focus from advanced search to basic listing operations. There is no evidence of security vulnerability, incident, or weakness being addressed. The change appears to be simplifying user guidance rather than addressing security concerns.
Diff
diff --git a/acm/latest/userguide/gs-acm-list.md b/acm/latest/userguide/gs-acm-list.md index 8985af6cf..3812b4f81 100644 --- a//acm/latest/userguide/gs-acm-list.md +++ b//acm/latest/userguide/gs-acm-list.md @@ -5 +5 @@ -# Search certificates managed by AWS Certificate Manager +# List certificates managed by AWS Certificate Manager @@ -7 +7 @@ -With the ACM console or AWS CLI, you can search for certificates in your account. The [SearchCertificates](https://docs.aws.amazon.com/acm/latest/APIReference/API_SearchCertificates.html) operation provides advanced filtering capabilities. You can filter certificates by ARN, X.509 attributes, and ACM specific properties like certificate status, type and renewal eligibility. You can also combine filters with AND, OR, and NOT logical operators. +You can use the ACM console or AWS CLI to list the certificates managed by ACM. The console can list up to 500 certificates in a page, and the CLI up to 1000. @@ -9,69 +9 @@ With the ACM console or AWS CLI, you can search for certificates in your account -###### Note - -The [ListCertificates](https://docs.aws.amazon.com/acm/latest/APIReference/API_ListCertificates.html) operation still exists for basic listing with limited filtering options such as key type, key usage, and certificate status. - -###### Filter categories - -You can filter certificates using the following categories: - - * **Certificate ARN** – Filter by the Amazon Resource Name of the certificate. - - * **X.509 attributes** – Filter by subject common name, subject alternative name, extended key usage, key usage, key algorithm, serial number, expiration date range (NotAfter), or validity start date range (NotBefore). Date range filters are inclusive of both the start and end dates. For example, to find all certificates for a specific domain, use the common name and DNS filters together with an OR operator. - - * **ACM metadata** – Filter by status, type, in-use, exported, export option, managed-by, validation method, renewal status, or renewal eligibility. - - - - -String filters support the CONTAINS and EQUALS comparison operators. You can combine multiple filters using AND, OR, and NOT logical operators. - -###### Sorting - -You can sort results by the following fields: - - * `CREATED_AT` - - * `NOT_AFTER` - - * `STATUS` - - * `RENEWAL_STATUS` - - * `EXPORTED` - - * `IN_USE` - - * `NOT_BEFORE` - - * `KEY_ALGORITHM` - - * `TYPE` - - * `CERTIFICATE_ARN` - - * `COMMON_NAME` - - * `REVOKED_AT` - - * `RENEWAL_ELIGIBILITY` - - * `ISSUED_AT` - - * `MANAGED_BY` - - * `EXPORT_OPTION` - - * `VALIDATION_METHOD` - - * `IMPORTED_AT` - - - - -Sort order can be `ASCENDING` or `DESCENDING`. - -###### Pagination - -Results are paginated. The `MaxResults` parameter defaults to 100 and accepts a maximum value of 500. Use the `NextToken` parameter to retrieve additional pages of results. - -###### To search your certificates using the console +###### To list your certificates using the console @@ -81,3 +13 @@ Results are paginated. The `MaxResults` parameter defaults to 100 and accepts a - 2. Use the property filter bar to search and filter certificates. You can filter by properties such as common name, status, type, key algorithm, and more. Combine filters with AND or OR operators to narrow your results. - - 3. Review the information in the certificate list. You can navigate through multiple pages of certificates by using the page numbers. Each certificate occupies a row. The following columns are displayed by default: + 2. Review the information in the certificate list. You can navigate through multiple pages of certificates using the page numbers at upper-right. Each certificate occupies a row with the following columns displayed by default for each certificate: @@ -101 +31 @@ Results are paginated. The `MaxResults` parameter defaults to 100 and accepts a -To customize the certificate list display, choose the settings icon. You can change the number of certificates shown on a page, specify the line-wrapping behavior of cell contents, and display additional information fields. The following optional fields are available: +By choosing the settings icon in the upper-right corner of the console, you can customize the number of certificates shown on a page, specify the line-wrapping behavior of cell contents, and display additional information fields. The following optional fields are available: @@ -130,7 +60 @@ For more information about the available certificate details, see [View AWS Cert -###### To search your certificates using the AWS CLI - - * Use the [search-certificates](https://docs.aws.amazon.com/cli/latest/reference/acm/search-certificates.html) command to search for ACM-managed certificates. The following example filters for certificates with a status of `ISSUED`: - - $ aws acm search-certificates \ - --filter-statement '{"Filter": {"AcmCertificateMetadataFilter": {"Status": "ISSUED"}}}' \ - --max-results 10 +**To list your certificates using the AWS CLI** @@ -137,0 +62 @@ For more information about the available certificate details, see [View AWS Cert +Use the [list-certificates](https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html) command to list your ACM-managed certificates as shown in the following example: @@ -139,0 +65 @@ For more information about the available certificate details, see [View AWS Cert + $ aws acm list-certificates --max-items 10 @@ -145 +71 @@ The command returns information similar to the following: - "Results": [ + "CertificateSummaryList": [ @@ -148,20 +74,4 @@ The command returns information similar to the following: - "X509Attributes": { - "Issuer": { - "CommonName": "Example CA", - "Country": "US", - "Organization": "Example Corp" - }, - "Subject": { - "CommonName": "example.com" - }, - "SubjectAlternativeNames": [ - { - "DnsName": "example.com" - }, - { - "DnsName": "www.example.com" - } - ], - "ExtendedKeyUsages": [ - "TLS_WEB_SERVER_AUTHENTICATION", - "TLS_WEB_CLIENT_AUTHENTICATION" + "DomainName": "example.com" + "SubjectAlternativeNameSummaries": [ + "example.com", + "other.example.com" @@ -169 +79,4 @@ The command returns information similar to the following: - "KeyAlgorithm": "RSA_2048", + "HasAdditionalSubjectAlternativeNames": false, + "Status": "ISSUED", + "Type": "IMPORTED", + "KeyAlgorithm": "RSA-2048", @@ -174,17 +87,2 @@ The command returns information similar to the following: - "SerialNumber": "serial_number", - "NotAfter": "2025-02-14T23:59:59+00:00", - "NotBefore": "2024-01-15T00:00:00+00:00" - }, - "CertificateMetadata": { - "AcmCertificateMetadata": { - "CreatedAt": "2024-01-15T12:00:00+00:00", - "IssuedAt": "2024-01-15T12:05:00+00:00", - "Exported": false, - "InUse": true, - "RenewalEligibility": "ELIGIBLE", - "Status": "ISSUED", - "Type": "AMAZON_ISSUED", - "ValidationMethod": "DNS" - } - } - } + "ExtendedKeyUsages": [ + "NONE" @@ -192 +90,8 @@ The command returns information similar to the following: - "NextToken": "nextToken" + "InUse": false, + "RenewalEligibility": "INELIGIBLE", + "NotBefore": "2022-06-14T23:42:49+00:00", + "NotAfter": "2032-06-11T23:42:49+00:00", + "CreatedAt": "2022-08-25T19:28:05.531000+00:00", + "ImportedAt": "2022-08-25T19:28:05.544000+00:00" + },... + ] @@ -194,0 +100,5 @@ The command returns information similar to the following: +By default, only certificates with **keyTypes** `RSA_1024` or `RSA_2048` and with at least one specified domain are returned. To see other certificates that you control, such as domainless certificates or certificates using a different algorithm or bit size, provide the `--includes` parameter as shown in the following example. The parameter allows you to specify a member of the [Filters](https://docs.aws.amazon.com/acm/latest/APIReference/API_Filters.html) structure. + + + $ aws acm list-certificates --max-items 10 --includes keyTypes=RSA_4096 +